The 'url' of 'package-repositories' can't handle PPA token from the environment variable
Metadata
Current evaluation
Untriaged request to expand environment variables in APT repository URLs so private PPA credentials can stay out of snapcraft.yaml; no maintainer response.
Suggested action: needs triage
Reason: The report provides a concrete configuration, command, and observed literal ${PPA_ACCESS_TOKEN} in the generated sources file. Current code passes project.package_repositories directly to craft-archives without visible expansion, but the issue remains untriaged with no labels, comments, assignee, or maintainer response.
Evaluated by: mr-cal-bot
Impact:
52
Quick Win:
19
Complexity:
55
Confidence:
91
Actionability:
82
Issue body
snapcraft version: 7.2.9, rev 8619
snapcraft.yaml content:
package-repositories:
- type: apt
architectures: [arm64]
components: [main]
suites: [jammy]
key-id: <PPA ID>
url: https://${PPA_ACCESS_TOKEN}@private-ppa.launchpadcontent.net/<team>/<project>/ubuntu
Build command:
sudo env PPA_ACCESS_TOKEN="<account>:<token>" SNAPCRAFT_BUILD_ENVIRONMENT="host" snapcraft
Problem:
Since the PPA token is sensitive information for account permission.
In general, we will not put the token content into snapcraft.yaml directly and use an environment parameter to provide the token content.
We found the 'url' of 'package-repositories' can't handle token from the environment variable.
The snapcraft create /etc/apt/sources.list.d/snapcraft-https_PPA_ACCESS_TOKEN_private_ppa_launchpadcontent..._ubuntu.sources directly with "URIs: https://${PPA_ACCESS_TOKEN}@private-ppa.launchpadcontent.net/<team>/<project>/ubuntu"
Is this expected behavior? If yes, could the team make snapcraft support to transfer url with the environment parameter? The reason is we should not put PPA token information from somebody's account and upload it to a public place.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
52
Quick Win:
19
Complexity:
55
Confidence:
91
Actionability:
82
|
needs triage | Untriaged request to expand environment variables in APT repository URLs so private PPA credentials can stay out of snapcraft.yaml; no maintainer response. | |
| stealth/space-bunny-alpha |
Impact:
45
Quick Win:
17
Complexity:
55
Confidence:
89
Actionability:
82
|
needs triage | Untriaged request to expand environment variables in APT package-repository URLs so private PPA credentials stay out of snapcraft.yaml; no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
50
Quick Win:
32
Staleness:
85
Complexity:
35
Confidence:
55
Support Request:
15
|
needs triage | Feature request: snapcraft should expand environment variables in package-repositories URL fields to avoid embedding sensitive PPA tokens in snapcraft.yaml | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
20
Confidence:
90
Support Request:
10
|
close stale | Request to support environment variable expansion in package-repositories URLs for PPA authentication. Inactive for over 3.5 years with no maintainer response. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
40
Confidence:
85
Support Request:
50
|
close stale | snapcraft fails to expand environment variables in package-repositories URLs, writing them literally. Untriaged feature request inactive for over 3 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
25
Confidence:
85
Support Request:
10
|
close stale | Requests environment variable expansion in package-repositories URLs to avoid hardcoding PPA tokens. Issue is over 3 years old with no maintainer response or activity. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.